This is very interesting and I'm just amazed on where the new innovations heading!
This is how the isolation is maintained!
Parent EC2 Instance
├── kubelet / containerd / Firecracker / device backends ← still running
└── Nitro Sandbox (sibling VM)
└── Your container(s) + guest kernel
Containers were never built to be a security boundary. So we gave each one its own VM.
AWS Nitro Sandboxes brings hardware isolation to every Amazon EKS pod, ECS task, and EC2 workload. Same containers, real VM boundary, one line to turn on.
No additional charge.
go.aws/4iO7zqS
3
56